{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.9.4"}],"component":"nltk","cve_ids":["CVE-2026-12243"],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m42h-3232-vpv3","id":"tcs_01M5KHCB60SBVGD3Z4E83CJAAQ","modified_at":"2026-08-19T12:15:03.321869900Z","published_at":"2026-06-30T01:16:29.063Z","references":["https://osv.dev/vulnerability/PYSEC-2026-597","https://huntr.com/bounties/39aa9354-54ca-4e77-96da-580eb1fe6ed1","https://github.com/advisories/GHSA-m42h-3232-vpv3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-597","url":"https://osv.dev/vulnerability/PYSEC-2026-597"}],"summary":"NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but"}